bafkreicvnlj7kaxjwusvx4qfwuanpnvpa5242uvakqze47avqlt2odjmra[.]ipfs[.]dweb[.]link

This domain operates as a high-risk credential-harvesting phishing portal targeting email account credentials. The page presents a fraudulent login interface under the title 'EmailLogin,' designed to deceive users into submitting sensitive authentication details. Analysis indicates the site employs social engineering tactics to replicate legitimate email service providers, increasing the likelihood of successful credential theft from unsuspecting victims. Infrastructure analysis reveals the domain was registered through CSC Corporate Domains, Inc. on February 24, 2017, and currently resolves to the IP address 209.94.90.3. Detection metrics from VirusTotal show 17 out of 95 security vendors have flagged this domain as malicious, with a classification of 'generic_phishing.' The domain remains active and utilizes a Let's Encrypt SSL certificate, which may lend an appearance of legitimacy to users unfamiliar with phishing indicators. Users who have visited this domain or entered credentials should immediately revoke any submitted login details from all associated accounts. System administrators are advised to block the IP address 209.94.90.3 at the network perimeter and add the domain to web filtering solutions. Affected individuals should monitor accounts for unauthorized access and enable multi-factor authentication where available. Security teams should review logs for connections to the domain or IP to identify potential compromise within their networks.